将进程提权至DEBUG级别

定义个结构

[StructLayout(LayoutKind.Sequential, Pack=1)] internal struct TokPriv1Luid { public int Count; public long Luid; public int Attr; }  

 

 

 

//引用API,设置基本参数 internal const int SE_PRIVILEGE_ENABLED = 0x00000002; internal const int TOKEN_QUERY = 0x00000008; internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020; internal const string SE_DEBUG_NAME = "SeDebugPrivilege"; [DllImport("kernel32.dll", ExactSpelling = true)] internal static extern IntPtr GetCurrentProcess(); //得到本进程句柄 [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok); //打开一个进程的访问令牌 [DllImport("advapi32.dll", SetLastError = true)] internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid); //修改进程权限 [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr relen); //更改进程令牌权限 public void Token() { bool ok; TokPriv1Luid tp; IntPtr hproc = GetCurrentProcess(); //欲打开访问令牌的进程句柄 IntPtr htok = IntPtr.Zero; //定义接收令牌句柄的指针 ok = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); //给htok赋值 if(ok){ MessageBox.Show("aa"); } tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_ENABLED; ok = LookupPrivilegeValue(null, SE_DEBUG_NAME, ref tp.Luid); if (ok) { MessageBox.Show("aa2"); } ok = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); if (ok) { MessageBox.Show("aa3"); } }